---
id: CVE-2026-43107
title: 'xfrm: account XFRMA_IF_ID in aevent size calculation'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: account XFRMA_IF_ID in aevent size calculation

  xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then
  build_aevent() appends attributes including…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e <
    f8f3bb89ab677db15f9f5250c77af728f9afe995
  - >-
    Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e <
    2c41283d94af943a05f7f2cc1a01f0c872f3cf43
  - >-
    Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e <
    e62e322ea20be78e346e4b49f9a6b9f03313af4c
  - >-
    Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e <
    58e5735d1a5373652f405a0c16e54ac04aaab0ad
  - >-
    Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e <
    7081d46d32312f1a31f0e0e99c6835a394037599
  - Linux 4.19
published: '2026-05-06'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:40:04.294Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43107'
references:
  - url: 'https://git.kernel.org/stable/c/f8f3bb89ab677db15f9f5250c77af728f9afe995'
  - url: 'https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43'
  - url: 'https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c'
  - url: 'https://git.kernel.org/stable/c/58e5735d1a5373652f405a0c16e54ac04aaab0ad'
  - url: 'https://git.kernel.org/stable/c/7081d46d32312f1a31f0e0e99c6835a394037599'
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.04963
ingestedAt: '2026-10-21T12:48:53.647Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: account XFRMA_IF_ID in aevent size calculation

xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then
build_aevent() appends attributes including XFRMA_IF_ID when x->if_id is
set.

xfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states
with if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0)
in xfrm_get_ae(), turning a malformed netlink interaction into a kernel
panic.

Account XFRMA_IF_ID in the size calculation unconditionally and replace
the BUG_ON with normal error unwinding.

## Affected

- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < f8f3bb89ab677db15f9f5250c77af728f9afe995`
- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 2c41283d94af943a05f7f2cc1a01f0c872f3cf43`
- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < e62e322ea20be78e346e4b49f9a6b9f03313af4c`
- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 58e5735d1a5373652f405a0c16e54ac04aaab0ad`
- `Linux >= 7e6526404adedf079279aa7aa11722deaca8fe2e < 7081d46d32312f1a31f0e0e99c6835a394037599`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.